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IN THE CLAIMS: 

1 1. (CURRENTLY AMENDED) A method for graphically presenting characteristics of data 

2 traffic on a distributed computer network, comprising: 

3 monitoring traffic on said network; 

4 storing records relating to said traffic in one or more network information files; 

5 selecting a characteristic of said traffic for display; 

6 obtaining a plurality of values of said characteristic of said traffic from said one or 

7 more network information files for §_selected plurality of time intervals within a larger time 

8 interval; and 

9 presenting said characteristic by playing a rapid succession of graphical images, each 

10 graphical image representing said network as nodes connected by lines, said nodes each rep- 
n resenting components in said network, said lines representing traffic flow between said 

12 components, each graphical image graphically representing the value of said characteristic at 

13 a particular selected time interval of said plurality of time intervals within the larger time in- 

14 terval with a property of at least one line of said lines that connect nodes representing com 

16 wherein a change in said property of said at least one line that connects nodes repre 

17 senting components in successive graphical images indicates a change in the value of said 
is characteristic of said traffic. 

i 2-3. (CANCELLED) 

i 4. (PREVIOUSLY PRESENTED) The method as in claim 1, further comprising: 
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2 using a width of said at least one line as said property, a change in said width indicat- 

3 ing a change in the value of said characteristic of said traffic. 

1 5. (PREVIOUSLY PRESENTED) The method as in claim 1, further comprising: 

2 using a color of said at least one line as said property, a change in said color indicat- 

3 ing a change in the value of said characteristic of said traffic. 

1 6. (PREVIOUSLY PRESENTED) The method as in claim 1 , further comprising: 

2 using an arrow drawn on said at least one line as said property, a change in said ar- 

3 row indicating a change in the value of said characteristic of said traffic. 

1 7. (PREVIOUSLY PRESENTED) The method as in claim 1 , further comprising: 

2 using a length of said at least one line as said property, a change in said length indi- 

3 eating a change in the value of said characteristic of said traffic. 

1 8. (PREVIOUSLY PRESENTED) The method as in claim 1 , further comprising: 

2 using a density of said at least one line as said property, a change in said density in- 

3 dicating a change in the value of said characteristic of said traffic. 

1 9. (PREVIOUSLY PRESENTED) The method as in claim 1 , further comprising: 

2 using a visual characteristic of said at least one line as said property, a change in said 

3 visual characteristic indicating a change in the value of said characteristic of said traffic. 

i 10. (CURRENTLY AMENDED) The method as in claim 1, further comprising: 
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2 displaying receiving a selection of a filtering expression in a graphical user interface; 

3 selecting , from said graphical user interface, records from said network information 

4 files ; and 

5 executing said filtering expression on the selected records to display said characteris 

6 tic of said traffic . 

1 11. (CURRENTLY AMENDED) The method as in claim 10, further comprising: 

2 calculating parameters that are associated with the records selected from said network 

3 information files and storing the parameters in a local file. 

i 12. (CANCELLED) 

1 13. (CURRENTLY AMENDED) The method as in claim 1 , further comprising: 

2 I using a filtering program to select records in said network information files that meet 

3 selected filtering criteria. 

1 14. (CURRENTLY AMENDED) The method as in claim 13, further comprising: 

2 compiling the selected records from said network information files during the se 

3 lected time intervals , each compiled record meeting at least one selected filtering criterion. 

1 15. (ORIGINAL) The method as in claim 14, further comprising: 

2 calculating data that represent the compiled records, and storing the data in a file. 
i 16. (PREVIOUSLY PRESENTED) The method as in claim 1, further comprising: 
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2 displaying a map of the network topology and overlaying the map with said succes- 

3 sion of graphical images. 

1 17. (PREVIOUSLY PRESENTED) The method of claim 14, further comprising: 

2 including a time interval criterion which indicates how often to compile and package 

3 information from the network information files. 

1 18. (PREVIOUSLY PRESENTED) The method of claim 1, further comprising: 

2 defining the larger time interval with a starting time and an ending time specified 

3 within a filtering criteria. 

1 19. (CURRENTLY AMENDED) A data visualization apparatus for graphically presenting 

2 characteristics of data traffic on a distributed computer network, comprising: 

3 means for monitoring traffic on said network; 

4 | means for storing records relating to said traffic: 

5 means for selecting characteristics of said traffic for display; 

6 means for obtaining a plurality of values of said characteristics of said traffic from 

7 said means for storing for a_selected plurality of time intervals within a larger time interval; 

8 and 

9 means for presenting said characteristics by playing a rapid succession of graphical 

10 images, each graphical image representing said network as nodes connected by lines, said 

n nodes each representing components in said network, said lines representing traffic flow be- 

12 tween said components, each graphical image graphically representing the value of said char- 

13 I acteristics at a particular time interval of said plurality of time intervals within the larger time 
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14 interval with a property of at least one line of said lines that connects nodes representing 

15 components , 

16 wherein a change in said property of said at least one line that connects nodes repre 

17 senting components in successive graphical images indicates a change in the value of said 
is characteristics of said traffic. 

i 20-21. (CANCELLED) 

1 22. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for using a width of said at least one line as said property, a change in said 

3 width indicating a change in the value of said characteristics of said traffic. 

1 23. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for a using a color of said at least one line as said property, a change in said 

3 color indicating a change in the value of said characteristics of said traffic. 

1 24. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for using an arrow drawn on said at least one line as said property, a change in 

3 said arrow indicating a change in the value of said characteristics of said traffic. 

1 25. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for using a length of said at least one line as said property, a change in said 

3 length indicating a change in the value of said characteristics of said traffic. 
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1 26. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for using a density of said at least one line as said property, a change in said 

3 density indicating a change in the value of said characteristics of said traffic. 

1 27. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for using a visual characteristic of said at least one line as said property, a 

3 change in said visual characteristic indicating a change in the value of said characteristics of 

4 said traffic. 

1 28. (CURRENTLY AMENDED) The apparatus as in claim 19, further comprising: 

2 means for displaying a receiving a selection of a filtering expression in a graphical 

3 user interface ; 

4 means for selecting , from said graphical user interface, records from network infor- 

5 mation files : and 

6 means for executing said filtering expression on the selected records to display said 

7 characteristics of said traffic . 

1 29. (CURRENTLY AMENDED) The apparatus as in claim 28, further comprising: 

2 means for calculating parameters that are associated with the records selected from 

3 | said networ k information files and storing the parameters in a local file. 

i 30. (CANCELLED) 

i 31. (ORIGINAL) The apparatus as in claim 19, further comprising: 
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2 means for using a filtering program to select records in network information files that 

3 meet selected filtering criteria. 

1 32. (CURRENTLY AMENDED) The apparatus as in claim 31, further comprising: 

2 means for compiling the selected records from said network information files during 

3 the selected time intervals , each compiled record meeting at least one selected filtering crite- 

4 rion. 

1 33. (ORIGINAL) The apparatus as in claim 32, further comprising: 

2 means for calculating data that represent the compiled records, and storing the data in 

3 a file. 

1 34. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for displaying a map of the network topology and overlaying the map with said 

3 succession of graphical images. 

1 35. (PREVIOUSLY PRESENTED) The apparatus as in claim 32, further comprising: 

2 means for including a time interval criterion which indicates how often to compile 

3 and package information from the network information files. 

1 36. (PREVIOUSLY PRESENTED) The apparatus as in claim 19, further comprising: 

2 means for defining the larger time interval with a starting time and an ending time 

3 specified within a filtering criteria. 
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37. (CURRENTLY AMENDED) A data visualization apparatus for graphically presenting 
characteristics of data traffic on a distributed computer network, comprising: 

a computer to monitor traffic on said network and store storing records relating to 
said traffic; 

a graphical user interface to select a characteristic of said traffic for display; 

a reporting system executing on said computer to obtain a plurality of values of said 
characteristic of said traffic from said stored records for a selected plurality of time intervals 
within a larger time interval; and 

a visualization system executing on said computer to present said characteristic by 
playing a rapid succession of graphical images, each graphical image representing said net- 
work as nodes connected by lines, said nodes each representing components in said network, 
said lines representing traffic flow between said components, each graphical image graphi- 
cally representing the value of said characteristic at a particular selected time interval of said 
plurality of time intervals within the larger time interval with a property of at least one line of 
said lines that connect nodes representing components , 



wherein a change in said property of said at least one line that connects nodes repre 



characteristic of said traffic. 
38-39. (CANCELLED) 

40. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a width of said at least one line as said 
property, a change in said width indicating a change in the value of said characteristic of said 
traffic. 





-in successive graphical images indicates a change in the value of said 
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41. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a color of said at least one line as said 
property, a change in said color indicating a change in the value of said characteristic of said 
traffic. 

42. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use an arrow drawn on said at least one 
line as said property, a change in said arrow indicating a change in the value of said charac- 
teristic of said traffic. 

43. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a length of said at least one line as said 
property, a change in said length indicating a change in the value of said characteristic of said 
traffic. 

44. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a density of said at least one line as 
said property, a change in said density indicating a change in the value of said characteristic 
of said traffic. 

45. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a visual characteristic of said at least 
one line as said property, a change in said visual characteristic indicating a change in the 
value of said characteristic of said traffic. 
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46. (CURRENTLY AMENDED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to display receive a selection of a filtering 
expression in a graphical user interface; 



instructions to execute in said computer to select , from said graphical user interface, 
records from network information files ; and 

instructions to execute in said computer to execute said filtering expression on the se- 
lected recorc 



47. (CURRENTLY AMENDED) The apparatus as in claim 46, further comprising: 

instructions to execute in said computer to calculate parameters that are associated 
with the records selected from said network information files and storing the parameters in a 
local file. 



48. (CANCELLED) 



49. (ORIGINAL) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a filtering program to select records in 
network information files that meet selected filtering criteria. 



50. (CURRENTLY AMENDED) The apparatus as in claim 49, further comprising: 

instructions to execute in said computer to compile the selected records from network 
information files during the selected time intervals, each compiled record meeting at least 
one selected filtering criterion. 
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51. (ORIGINAL) The apparatus as in claim 50, further comprising: 

instructions to execute in said computer to calculate data that represent the compiled 
records, and storing the data in a file. 

52. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to display a map of the network topology and 
overlaying the map with said succession of graphical images. 

53. (PREVIOUSLY PRESENTED) The apparatus as in claim 50, further comprising: 

instructions to execute in said computer to include a time interval criterion which in- 
dicates how often to compile and package information from the network information files. 

54. (PREVIOUSLY PRESENTED) The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to define the larger time interval with a start- 
ing time and an ending time specified within a filtering criteria. 

55-56. (CANCELLED) 

57. (PREVIOUSLY PRESENTED) A method comprising: 

monitoring data traffic in a distributed computer network; 

storing records relating to the data traffic in one or more network information files; 
selecting a characteristic of the data traffic for display; 

extracting data from the network information files related to the selected characteris- 
tic for a plurality of time intervals within a larger time interval; and 
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for each time interval within the larger time interval, generating a frame that visually 
depicts a map of the network topology of the distributed computer network, with nodes of the 
map representing network components, the nodes interconnected by lines that represent traf- 
fic flow between the network components, the frame to visually indicate a value of the char- 
acteristic of data traffic between two network components with the visual appearance of a 
line interconnecting the two nodes representing those two network components; and 

playing a rapid succession of frames to a user to illustrate changes in the characteris- 
tic of the data traffic over the larger time interval, wherein changes in the visual appearance 
of the line interconnecting the two nodes in successive frames indicate changes in the value 
of the characteristic of the data traffic between the two network components. 

58. (PREVIOUSLY PRESENTED) The method of claim 57 wherein the characteristic of the 
data traffic is a number of attempted long-ins. 

59. (PREVIOUSLY PRESENTED) The method of claim 57 wherein the characteristic of the 
data traffic is an amount of data traffic. 

60. (PREVIOUSLY PRESENTED) The method of claim 57 wherein the extracting selects 
data from the network information files using a filtering expression. 
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